CVE-2026-41136 PUBLISHED

free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer

Assigner: GitHub_M
Reserved: 17.04.2026 Published: 21.04.2026 Updated: 21.04.2026

free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the HTTPUEContextTransfer handler in internal/sbi/api_communication.go does not include a default case in the Content-Type switch statement. When a request arrives with an unsupported Content-Type, the deserialization step is silently skipped, err remains nil, and the processor is invoked with a completely uninitialized UeContextTransferRequest object. Version 1.4.3 contains a fix.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CVSS Score: 5.5

Product Status

Vendor free5gc
Product amf
Versions
  • Version < 1.4.3 is affected

References

Problem Types

  • CWE-440: Expected Behavior Violation CWE